Safety Culture vs. Safety Systems: Why the Conversation Needs to Shift

“Safety culture” is one of the most widely used phrases in EHS. It shows up in boardroom conversations, incident reviews, and annual reports. It signals commitment and suggests accountability.

But it also does something else:

It turns attention toward people, and away from how the organization is actually designed. That distinction matters more than most organizations realize; because when incidents happen, the difference between what people did and what the organization made possible is often the difference between surface-level fixes and meaningful risk reduction.

The problem with “safety culture” as the default explanation

In many incident reviews, the conclusion sounds familiar:

• “The culture needs improvement.”
• “There was a lack of accountability.”
• “People didn’t follow procedures.”

Those statements may be true, but they are rarely complete. Investigations across high-risk industries including repeated findings from the U.S. Chemical Safety Board have consistently pointed to organizational and system-level failures as underlying causes of major incidents.

Heather MacDougall made a substantive case for this in her papers “Moving Beyond Safety Culture: Why Language Matters in Building Strong Organizations” and “How Organizational Design Can Influence Safer, Healthier, and More Productive Workplaces”: when the language of “culture” becomes the primary explanation, it can obscure the organizational decisions that shape how work actually gets done.

And when that happens, “culture” doesn’t just describe the problem - it becomes the stopping point in the analysis.

What actually drives safety performance

There’s a practical distinction that often gets blurred: Culture reflects shared expectations and intent, but outcomes are produced by how the organization is structured, how decisions are made, how information flows, and how consistency is maintained.

In contractor-intensive environments, those outcomes are shaped long before work begins. They’re shaped by whether an organization can confidently answer questions like:

• Do we know this contractor’s safety documentation is current?
• Has required training been completed and verified?
• Does their insurance meet our requirements today, not last year?
• Are we applying the same standards across every site?

If the answer to any of those is unclear, the issue is not culture alone - it’s how the system has been designed to manage risk.

Where risk actually enters the organization

Most incidents don’t begin in the field. They begin earlier: in onboarding, inconsistent requirements, and gaps in verification. Consider a common scenario:

A contractor is approved to start work. They’ve worked with the company before. The team is under time pressure. Everything appears in order. But…

• Their safety documentation hasn’t been updated this year.
• Their insurance no longer meets current requirements.
• Their training records were submitted, but not verified.

No one made a reckless decision, but the organization allowed uncertainty to pass as compliance. That’s what systemic risk looks like in practice, and it often remains invisible until something goes wrong.

Safety is not just managed - it is designed

This is where the conversation needs to shift. Safety performance is not simply the result of individual behavior or even shared values. It’s the result of how the organization is designed to operate. That design shows up in places that are easy to overlook:

• How contractor requirements are defined
• How information is collected, reviewed, and validated
• Who has authority to approve or reject work
• How consistency is maintained across locations

When those elements are fragmented, safety becomes inconsistent. When they are structured, safety becomes repeatable. This is why organizations with similar stated “cultures” can produce very different outcomes; because culture does not standardize execution - design does.

Human error is often the last step - not the first

It’s easy to attribute incidents to human error, but that’s rarely where the story starts.

A worker misses a step. But why?

They weren’t fully trained. But why?

Training wasn’t verified. But why?

The system for managing information was incomplete or inconsistent. At that point, the issue is no longer individual behavior - it’s how the organization allowed critical information to break down.

What strong systems actually do

Effective safety systems are not complex for the sake of complexity. They’re structured to remove ambiguity and enforce consistency.

In practice, that means:

• Contractors go through a defined prequalification process with clear criteria
• That process is applied consistently across locations and teams
• Safety documentation and insurance are centralized, current, and accessible
• Requirements are verified, not assumed
• Training is completed, documented, and visible before work begins
• Information is continuously maintained so decisions are based on current data

None of this replaces culture, but it reduces the degree to which safety outcomes depend on it.

Why language still matters

Calling something a “culture issue” can feel constructive, but it can also be imprecise. And in safety, imprecision has consequences.

When organizations shift their language, they begin to ask different questions: Not “How do we improve culture?” but “Where is our design allowing gaps?” Not “Why didn’t they follow the process?” but “Was the process clear, consistent, and enforced?”

That shift moves the conversation from intention to execution.

The takeaway for EHS and risk leaders

Safety culture still matters, but it is not, by itself, a control mechanism. It does not verify documentation. It does not enforce consistency. It does not ensure that decisions are based on current, reliable information.

Those outcomes depend on how the organization is designed to operate.

And in environments where multiple contractors, locations, and teams intersect, that design is what determines whether risk is controlled or introduced.

Final thought

Most organizations don’t have a culture problem - they have a visibility problem. They lack consistent, verified, centralized information about the contractors working on their sites.

Until that changes, “safety culture” will continue to carry more weight than it should, because it’s easier to talk about than the systems that actually drive outcomes.

Organizations that make the shift away from abstract language and toward deliberate design don’t just improve safety performance. They make it repeatable. And repeatability is what turns good intentions into reliable results.

Learn how FIRST, VERIFY can provide the safety control system for your organization.